Can I make SSH ForwardAgent and ProxyJump work with Git?

user_388916 0
Viewed 607

I have two computers; my workstation and a laptop I use to run my company VPN. I need to go through the VPN in order to reach my Git remote (BitBucket).

I have an SSH agent running on my workstation that contains the SSH key needed to connect to the Git remote. I have configured SSH to forward my SSH agent when connecting to my laptop:

Host my-laptop
    ForwardAgent yes

If I use SSH to connect to my laptop, I can successfully git pull, and ssh-agent -l confirms that the SSH agent was properly forwarded. So far so good!

Here's the challenge: I want to use git directly from my workstation. This should be possibly by configuring SSH to proxy through my laptop. My git remotes look like this:

āžœ git remote -v
origin  ssh://git@bitbucket.my-company.com:7999/my-team/my-project.git (fetch)
origin  ssh://git@bitbucket.my-company.com:7999/my-team/my-project.git (push)

So I added this SSH configuration:

Host *.my-company.com
    ProxyJump my-laptop

The proxy jump worked, because now I reach the Git remote!

However, authentication fails:

git@bitbucket.my-company.com: Permission denied (publickey).
fatal: Could not read from remote repository.

Please make sure you have the correct access rights
and the repository exists.
exit status 128

So apparently SSH agent forwarding didn't work when proxying the command..?

Troubleshooting steps I have tried:

  • Connecting to the laptop with SSH and running git pull - it works

  • Running git pull directly from the laptop - it works

  • Adding IdentityFile and IdentitiesOnly to force the right key to be used, didn't make a difference:

    Host *.my-company.com
    ProxyJump my-laptop
    IdentityFile ~/.ssh/hubro@my-company.com.key
    IdentitiesOnly yes

  • Adding ForwardAgent yes when connecting to the Git remote host, didn't make a difference:

    Host *.my-company.com
    ProxyJump my-laptop
    ForwardAgent yes
    IdentityFile ~/.ssh/hubro@my-company.com.key
    IdentitiesOnly yes

So why isn't my local SSH agent being used when running git commands?

ssh-agent ssh git
2 Answers

It turns out I don't even need SSH agent forwarding in this setup, since the ProxyJump setting sets up a tunnel that lets my workstation communicate "directly" with the git remote.

The reason I was getting "Permission denied (publickey)" errors turns out to be that my distribution (Arch) is extremely up-to-date and have already disabled support for "ssh-rsa" keys by default. (At time of writing, Arch linux ships with openssh 8.8p1)

Frustratingly, it doesn't matter that I generate my key with "rsa-sha2-512", which should be secure, my SSH client still won't have it.

However, I generated a new key using ed25519 instead, and that solved my problem.

$ ssh-keygen -t ed25519
user_3889160

You don't need agent forwarding in your case, because you don't want to forward your key to the bitbucket.my-company.com server, you only want to authenticate there.

Forwarding a key owned by an intermediate proxy is not possible with ForwardAgent.

You need the correct key on your workstation, but it looks like that the key is only present on your laptop (Running git pull directly from the laptop - it works).

  1. You could copy the private key from your laptop to your workstation
  2. You can forward the key from the laptop to your workstation in one terminal and use that key with git in another terminal
user_4631150
Related